FROM node:24-bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl python3 make g++ \
    && rm -rf /var/lib/apt/lists/*
WORKDIR /app/backend
# Publish only these dependency manifests with this launcher. Application source
# lives in the PRIVATE mounted bucket, not in the public Space or image.
COPY package.json package-lock.json ./
RUN npm ci && chown -R node:node /app
ARG SOURCE_ARCHIVE=attendwise-google-e9d5f88a58f0.tar.gz
ARG SOURCE_SHA256=b3cb87adc0f33c1eb5e178b4f08d5e025717861359cc9fe68f8d62ab58bba788
ENV SOURCE_ARCHIVE=$SOURCE_ARCHIVE SOURCE_SHA256=$SOURCE_SHA256
ENV NODE_ENV=production PORT=7860
ENV ANDROID_ATTESTATION_SIGNING_SHA256=7eaa4ef307c94c78b4781c35b2bd6eebc7cce0511b427abb509ff55299196be5
USER node
EXPOSE 7860
CMD ["sh", "-c", "printf '%s  %s\\n' \"$SOURCE_SHA256\" \"/data/$SOURCE_ARCHIVE\" | sha256sum -c - && tar --no-same-owner -xzf \"/data/$SOURCE_ARCHIVE\" -C /app && exec node --import tsx src/hosting/space.ts"]